dsh-permission-rules 0.6.16 → 0.6.18

package/CHANGELOG.md

@@ -1,3 +1,28 @@
+## v0.6.18 - 2026-09-10
+
+### Docs
+
+- Five-language READMEs: the network-policy "Matching" bullet now states that IPv4-mapped IPv6 literals are normalized to their IPv4 form before matching, and that the proxy connects on the addresses the decision was made on (never a second DNS resolution). Republished so the npm page carries the updated READMEs.
+
+### Tests
+
+- No behavior change in this version: it republishes the 0.6.17 code (which already contains the network hardening below) with the refreshed documentation. Gate chain re-run green (285 tests, 23 files).
+
+## v0.6.17 - 2026-09-10
+
+### Security
+
+- **Hardening: the proxy now connects on the adjudicated address, never a second DNS resolution.** The proxy adjudicated a hostname on one `lookup()` and then connected by hostname, re-resolving — a hostname whose answers change between adjudication and connect (DNS rebinding, CWE-367) could reach an address the rules never approved. `decideWithResolution` now returns the target carrying the resolved addresses, CONNECT tunnels try those addresses in order (a 502 when none accepts), and the plain-HTTP forward pins `http(s).request` with a `lookup` answering from the same list, so a multi-address host keeps its fallbacks through happy-eyeballs ordering. End-to-end guards live in `test/proxy.spec.ts` (plain HTTP and CONNECT, literal and CIDR `ips` rules, plus named-target forwarding); `AGENTS.md` and both `rules-format` docs record the behavior.
+
+### Changed
+
+- Pin the `@deepseek-ai/dsh-*` dev/test dependencies to the published `0.1.5-rc.1` line and record `0.1.5-rc.1` in `dshWorkshop.compatibility.dshVersions`; the monthly Compat workflow now runs against `0.1.5-rc.1`. The peer range `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0` is unchanged, so no supported host line is dropped.
+- Vendor integration tarball updated to `dsh-auto-review` 0.12.2 (`vendor/dsh-auto-review-0.12.2.tgz`, packed from the sibling repo at tag `v0.12.2`; the packed `files` are byte-identical to that tag's checkout), with the devDependency `file:` specifier and `pnpm-lock.yaml` refreshed. The sibling's runtime `@deepseek-ai/dsh-*` pins now follow the `0.1.5-rc.1` host line, matching this repo's dev peers. The six historical vendor tarballs (`0.9.0`–`0.12.1`) stay in the tree.
+
+### Docs
+
+- Refresh the five-language README compatibility baseline to `dsh-v0.1.5-rc.1` (verified 2026-09-10).
+
 ## v0.6.16 - 2026-09-09
 
 ### Security

package/README.es.md

@@ -26,7 +26,7 @@
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.1.5-alpha.1` (adaptado el 2026-09-09, cadena completa de gates + smoke de instalación de profile): su `Session.append` todavía no puede estampar el marcador `ignorable` —verificado en el paquete publicado `0.1.5-alpha.1`, donde el tercer argumento se descarta silenciosamente y el campo del sobre solo sobrevive para la lectura de logs almacenados—, así que toda la línea `0.1.5-alpha` se preverifica como no marcada y la auditoría del registro de sesión queda desactivada por defecto. La línea `0.1.3-alpha` mantiene la misma firma de append surface-only. Las migraciones de log de ambas líneas rechazan eventos de plugin sin clasificar incluso marcados: aplica `strip` a las filas de auditoría v1 antes de que un host `0.1.3-alpha` abra el log y a las v2 antes de que un host `0.1.5-alpha` lo migre (los logs v3 nativos solo necesitan `repair`). |
+| Harness | DeepSeek Harness `dsh-v0.1.5-rc.1` (adaptado el 2026-09-09, cadena completa de gates + smoke de instalación de profile): su `Session.append` todavía no puede estampar el marcador `ignorable` —verificado en el paquete publicado `0.1.5-rc.1`, donde el tercer argumento se descarta silenciosamente y el campo del sobre solo sobrevive para la lectura de logs almacenados—, así que toda la línea `0.1.5-alpha` se preverifica como no marcada y la auditoría del registro de sesión queda desactivada por defecto. La línea `0.1.3-alpha` mantiene la misma firma de append surface-only. Las migraciones de log de ambas líneas rechazan eventos de plugin sin clasificar incluso marcados: aplica `strip` a las filas de auditoría v1 antes de que un host `0.1.3-alpha` abra el log y a las v2 antes de que un host `0.1.5-alpha` lo migre (los logs v3 nativos solo necesitan `repair`). |
 | Node | `^22.19.0 || >=24.0.0` |
 | Platforms | Todas (host + cliente web de settings) |
 | Model | Cualquiera (las razones deny/ask se muestran a través de los resultados de herramienta) |
@@ -76,7 +76,7 @@ Una **política de red a nivel de proceso** estilo Codex: el tráfico de subproc
 - **`allow-all`** — el preset danger-full-access: permitir todo.
 - **`auto`** (por defecto) — sigue el preset del sandbox; en hosts sin el servicio de política de sandbox se resuelve a `autoFallback` (`allow-all`).
 
-- **Emparejamiento** — `match.network` con `domains` / `ips` / `ports` / `schemes` (globs, comodines, CIDR, rangos de puertos; se aceptan puertos YAML numéricos). La extracción de candidatos URL en la ruta caliente `tools/pre-execute` se dispara sobre argumentos de herramientas web y URLs embebidas en texto de comandos bash/pwsh; los destinos de loopback pueden cortocircuitar reglas según la política `loopback`.
+- **Emparejamiento** — `match.network` con `domains` / `ips` / `ports` / `schemes` (globs, comodines, CIDR, rangos de puertos; se aceptan puertos YAML numéricos). La extracción de candidatos URL en la ruta caliente `tools/pre-execute` se dispara sobre argumentos de herramientas web y URLs embebidas en texto de comandos bash/pwsh; los destinos de loopback pueden cortocircuitar reglas según la política `loopback`. Los literales IPv6 mapeados a IPv4 se normalizan a su forma IPv4 antes de comparar, y el proxy se conecta a las direcciones con las que se tomó la decisión, sin una segunda resolución DNS.
 - **Auditoría** — las conexiones denegadas anexan `permissionRules/network` a la sesión propietaria (la misma puerta adaptativa `ignorable`), con contadores de bloqueo e intercepciones recientes en `/rules network` y la página de settings.
 
 ## Quick start

package/README.hi.md

@@ -26,7 +26,7 @@
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.1.5-alpha.1` (2026-09-09 को अनुकूलित, पूर्ण gates शृंखला + profile इंस्टॉल smoke): इसका `Session.append` अभी भी `ignorable` मार्कर स्टैम्प नहीं कर सकता — प्रकाशित `0.1.5-alpha.1` पैकेज पर सत्यापित, जहाँ तीसरा आर्ग्युमेंट चुपचाप छोड़ दिया जाता है और लिफ़ाफ़ा फ़ील्ड केवल संग्रहीत-लॉग पठन के लिए बचता है — इसलिए पूरी `0.1.5-alpha` पंक्ति पहले append से पहले ही अनमार्क्ड के रूप में पूर्व-जाँची जाती है और सत्र-लॉग ऑडिट डिफ़ॉल्ट रूप से बंद रहता है। `0.1.3-alpha` पंक्ति वही surface-only append हस्ताक्षर रखती है। दोनों पंक्तियों का लॉग प्रवासन चिह्नित अन-क्लासिफ़ाइड प्लगइन घटनाओं को भी अस्वीकारता है: `0.1.3-alpha` host के लॉग खोलने से पहले v1 ऑडिट पंक्तियाँ और `0.1.5-alpha` host के प्रवासन से पहले v2 पंक्तियाँ `strip` करें (v3 मूल लॉग के लिए केवल `repair` चाहिए)। |
+| Harness | DeepSeek Harness `dsh-v0.1.5-rc.1` (2026-09-09 को अनुकूलित, पूर्ण gates शृंखला + profile इंस्टॉल smoke): इसका `Session.append` अभी भी `ignorable` मार्कर स्टैम्प नहीं कर सकता — प्रकाशित `0.1.5-rc.1` पैकेज पर सत्यापित, जहाँ तीसरा आर्ग्युमेंट चुपचाप छोड़ दिया जाता है और लिफ़ाफ़ा फ़ील्ड केवल संग्रहीत-लॉग पठन के लिए बचता है — इसलिए पूरी `0.1.5-alpha` पंक्ति पहले append से पहले ही अनमार्क्ड के रूप में पूर्व-जाँची जाती है और सत्र-लॉग ऑडिट डिफ़ॉल्ट रूप से बंद रहता है। `0.1.3-alpha` पंक्ति वही surface-only append हस्ताक्षर रखती है। दोनों पंक्तियों का लॉग प्रवासन चिह्नित अन-क्लासिफ़ाइड प्लगइन घटनाओं को भी अस्वीकारता है: `0.1.3-alpha` host के लॉग खोलने से पहले v1 ऑडिट पंक्तियाँ और `0.1.5-alpha` host के प्रवासन से पहले v2 पंक्तियाँ `strip` करें (v3 मूल लॉग के लिए केवल `repair` चाहिए)। |
 | Node | `^22.19.0 || >=24.0.0` |
 | Platforms | सभी (host + वेब settings क्लाइंट) |
 | Model | कोई भी (deny/ask कारण टूल परिणामों के माध्यम से दिखते हैं) |
@@ -76,7 +76,7 @@ Codex-शैली की **प्रक्रिया-स्तरीय न
 - **`allow-all`** — danger-full-access preset: सब कुछ अनुमत।
 - **`auto`** (डिफ़ॉल्ट) — sandbox preset का अनुसरण करता है; बिना sandbox-नीति सेवा वाले hosts पर `autoFallback` (`allow-all`) में हल होता है।
 
-- **मिलान** — `match.network` `domains` / `ips` / `ports` / `schemes` के साथ (globs, वाइल्डकार्ड, CIDR, पोर्ट श्रेणियाँ; संख्यात्मक YAML पोर्ट स्वीकृत)। `tools/pre-execute` हॉट पथ पर URL-उम्मीदवार निष्कर्षण वेब-टूल तर्कों और bash/pwsh कमांड टेक्स्ट में एम्बेडेड URLs पर चलता है; लूपबैक लक्ष्य `loopback` नीति के अनुसार नियमों को शॉर्ट-सर्किट कर सकते हैं।
+- **मिलान** — `match.network` `domains` / `ips` / `ports` / `schemes` के साथ (globs, वाइल्डकार्ड, CIDR, पोर्ट श्रेणियाँ; संख्यात्मक YAML पोर्ट स्वीकृत)। `tools/pre-execute` हॉट पथ पर URL-उम्मीदवार निष्कर्षण वेब-टूल तर्कों और bash/pwsh कमांड टेक्स्ट में एम्बेडेड URLs पर चलता है; लूपबैक लक्ष्य `loopback` नीति के अनुसार नियमों को शॉर्ट-सर्किट कर सकते हैं। IPv4-मैप्ड IPv6 लिटरल तुलना से पहले IPv4 रूप में सामान्यीकृत होते हैं, और प्रॉक्सी उन्हीं पतों पर कनेक्ट करता है जिन पर निर्णय लिया गया — दूसरा DNS रिज़ॉल्यूशन नहीं।
 - **ऑडिट** — अस्वीकृत कनेक्शन स्वामी सत्र में `permissionRules/network` जोड़ते हैं (वही अनुकूली `ignorable` द्वार), `/rules network` और settings पृष्ठ में ब्लॉक काउंटर व हाल की अवरोधन के साथ।
 
 ## Quick start

package/README.md

@@ -27,7 +27,7 @@
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.1.5-alpha.1` (adapted 2026-09-09, full gate chain + profile install smoke): its `Session.append` still cannot stamp the `ignorable` marker — verified on the published `0.1.5-alpha.1` package, where the third argument is silently dropped and the envelope field survives for stored-log reads only — so the whole `0.1.5-alpha` line is pre-checked as unmarked and session-log audit stays disabled by default. The `0.1.3-alpha` line keeps the same surface-only append signature. Both lines' log migrations refuse unclassified plugin events even when marked, so `strip` v1 audit rows before a `0.1.3-alpha` host opens the log and v2 audit rows before a `0.1.5-alpha` host migrates it (native v3 logs only need `repair`). |
+| Harness | DeepSeek Harness `dsh-v0.1.5-rc.1` (adapted 2026-09-09, full gate chain + profile install smoke): its `Session.append` still cannot stamp the `ignorable` marker — verified on the published `0.1.5-rc.1` package, where the third argument is silently dropped and the envelope field survives for stored-log reads only — so the whole `0.1.5-alpha` line is pre-checked as unmarked and session-log audit stays disabled by default. The `0.1.3-alpha` line keeps the same surface-only append signature. Both lines' log migrations refuse unclassified plugin events even when marked, so `strip` v1 audit rows before a `0.1.3-alpha` host opens the log and v2 audit rows before a `0.1.5-alpha` host migrates it (native v3 logs only need `repair`). |
 | Node | `^22.19.0 || >=24.0.0` |
 | Platforms | All (host + web settings client) |
 | Model | Any (deny/ask reasons surface through tool results) |
@@ -77,7 +77,7 @@ A Codex-style **process-level network policy**: shell subprocess traffic flows t
 - **`allow-all`** — the danger-full-access preset: allow everything.
 - **`auto`** (default) — follows the sandbox preset; on hosts without the sandbox-policy service it resolves to `autoFallback` (`allow-all`).
 
-- **Matching** — `match.network` with `domains` / `ips` / `ports` / `schemes` (globs, wildcards, CIDRs, port ranges; numeric YAML ports are accepted). URL-candidate extraction on the `tools/pre-execute` hot path fires on web-tool arguments and URLs embedded in bash/pwsh command text; loopback targets can short-circuit rules per `loopback` policy.
+- **Matching** — `match.network` with `domains` / `ips` / `ports` / `schemes` (globs, wildcards, CIDRs, port ranges; numeric YAML ports are accepted). URL-candidate extraction on the `tools/pre-execute` hot path fires on web-tool arguments and URLs embedded in bash/pwsh command text; loopback targets can short-circuit rules per `loopback` policy. IPv4-mapped IPv6 literals are normalized to their IPv4 form before matching, and the proxy connects on the addresses the decision was made on — never a second DNS resolution.
 - **Audit** — denied connections append `permissionRules/network` to the owning session (same adaptive `ignorable` gate), with block counters and recent interceptions in `/rules network` and the settings page.
 
 ## Quick start

package/README.pt.md

@@ -26,7 +26,7 @@
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.1.5-alpha.1` (adaptado em 2026-09-09, cadeia completa de gates + smoke de instalação de profile): o `Session.append` ainda não consegue estampar o marcador `ignorable` — verificado no pacote publicado `0.1.5-alpha.1`, onde o terceiro argumento é descartado silenciosamente e o campo do envelope só sobrevive para a leitura de logs armazenados —, então toda a linha `0.1.5-alpha` é pré-verificada como não marcada e a auditoria do log de sessão fica desativada por padrão. A linha `0.1.3-alpha` mantém a mesma assinatura de append surface-only. As migrações de log de ambas as linhas recusam eventos de plugin não classificados mesmo marcados: aplique `strip` nas linhas de auditoria v1 antes de um host `0.1.3-alpha` abrir o log e nas v2 antes de um host `0.1.5-alpha` migrá-lo (logs v3 nativos só precisam de `repair`). |
+| Harness | DeepSeek Harness `dsh-v0.1.5-rc.1` (adaptado em 2026-09-09, cadeia completa de gates + smoke de instalação de profile): o `Session.append` ainda não consegue estampar o marcador `ignorable` — verificado no pacote publicado `0.1.5-rc.1`, onde o terceiro argumento é descartado silenciosamente e o campo do envelope só sobrevive para a leitura de logs armazenados —, então toda a linha `0.1.5-alpha` é pré-verificada como não marcada e a auditoria do log de sessão fica desativada por padrão. A linha `0.1.3-alpha` mantém a mesma assinatura de append surface-only. As migrações de log de ambas as linhas recusam eventos de plugin não classificados mesmo marcados: aplique `strip` nas linhas de auditoria v1 antes de um host `0.1.3-alpha` abrir o log e nas v2 antes de um host `0.1.5-alpha` migrá-lo (logs v3 nativos só precisam de `repair`). |
 | Node | `^22.19.0 || >=24.0.0` |
 | Platforms | Todas (host + cliente web de settings) |
 | Model | Qualquer (razões deny/ask aparecem pelos resultados de ferramenta) |
@@ -76,7 +76,7 @@ Uma **política de rede em nível de processo** estilo Codex: o tráfego de subp
 - **`allow-all`** — o preset danger-full-access: permitir tudo.
 - **`auto`** (padrão) — segue o preset do sandbox; em hosts sem o serviço de política de sandbox resolve para `autoFallback` (`allow-all`).
 
-- **Correspondência** — `match.network` com `domains` / `ips` / `ports` / `schemes` (globs, curingas, CIDR, faixas de porta; portas YAML numéricas são aceitas). A extração de candidatos URL na rota quente `tools/pre-execute` dispara sobre argumentos de ferramentas web e URLs embutidas em texto de comando bash/pwsh; destinos de loopback podem curto-circuitar regras conforme a política `loopback`.
+- **Correspondência** — `match.network` com `domains` / `ips` / `ports` / `schemes` (globs, curingas, CIDR, faixas de porta; portas YAML numéricas são aceitas). A extração de candidatos URL na rota quente `tools/pre-execute` dispara sobre argumentos de ferramentas web e URLs embutidas em texto de comando bash/pwsh; destinos de loopback podem curto-circuitar regras conforme a política `loopback`. Literais IPv6 mapeados em IPv4 são normalizados para a forma IPv4 antes da comparação, e o proxy conecta nos endereços usados na decisão, sem uma segunda resolução DNS.
 - **Auditoria** — conexões negadas anexam `permissionRules/network` à sessão proprietária (a mesma porta adaptativa `ignorable`), com contadores de bloqueio e intercepções recentes em `/rules network` e na página de settings.
 
 ## Quick start

package/README.zh.md

@@ -26,7 +26,7 @@
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.1.5-alpha.1`（2026-09-09 已适配，完整门禁链 + profile 安装冒烟）：其 `Session.append` 仍无法盖章 `ignorable` 标记——已在已发布的 `0.1.5-alpha.1` 包上实测，第三参数被静默丢弃，信封字段仅用于存量日志读取——故整条 `0.1.5-alpha` 线在首次追加前即被预检为未盖章，会话日志审计默认停用。`0.1.3-alpha` 线同样沿用 surface-only 追加签名。两条线的日志迁移连已标记的未分类插件事件也拒绝：在 `0.1.3-alpha` 宿主打开日志前 `strip` 掉 v1 审计行，在 `0.1.5-alpha` 宿主迁移前 `strip` 掉 v2 审计行（v3 原生日志只需 `repair`）。 |
+| Harness | DeepSeek Harness `dsh-v0.1.5-rc.1`（2026-09-09 已适配，完整门禁链 + profile 安装冒烟）：其 `Session.append` 仍无法盖章 `ignorable` 标记——已在已发布的 `0.1.5-rc.1` 包上实测，第三参数被静默丢弃，信封字段仅用于存量日志读取——故整条 `0.1.5-alpha` 线在首次追加前即被预检为未盖章，会话日志审计默认停用。`0.1.3-alpha` 线同样沿用 surface-only 追加签名。两条线的日志迁移连已标记的未分类插件事件也拒绝：在 `0.1.3-alpha` 宿主打开日志前 `strip` 掉 v1 审计行，在 `0.1.5-alpha` 宿主迁移前 `strip` 掉 v2 审计行（v3 原生日志只需 `repair`）。 |
 | Node | `^22.19.0 || >=24.0.0` |
 | Platforms | 全部（host + Web 设置客户端） |
 | Model | 任意（deny/ask 原因经工具结果呈现） |
@@ -76,7 +76,7 @@ Codex 风格的**进程级网络策略**：shell 子进程流量经内置本地
 - **`allow-all`** —— danger-full-access 预设：放行一切。
 - **`auto`**（默认）—— 跟随沙箱预设；无沙箱策略服务的宿主上解析为 `autoFallback`（`allow-all`）。
 
-- **匹配** —— `match.network` 用 `domains` / `ips` / `ports` / `schemes`（glob、通配符、CIDR、端口范围；数值型 YAML 端口可接受）。`tools/pre-execute` 热路径上的 URL 候选抽取作用于 web 工具参数与嵌入 bash/pwsh 命令文本的 URL；回环目标可按 `loopback` 策略短路规则。
+- **匹配** —— `match.network` 用 `domains` / `ips` / `ports` / `schemes`（glob、通配符、CIDR、端口范围；数值型 YAML 端口可接受）。`tools/pre-execute` 热路径上的 URL 候选抽取作用于 web 工具参数与嵌入 bash/pwsh 命令文本的 URL；回环目标可按 `loopback` 策略短路规则。IPv4 映射的 IPv6 字面量在匹配前归一化为 IPv4 形式；代理按裁决到的地址建连，不做二次 DNS 解析。
 - **审计** —— 被拒连接向所属会话追加 `permissionRules/network`（同样的自适应 `ignorable` 门），块计数器与近期拦截在 `/rules network` 与设置页展示。
 
 ## Quick start

package/docs/rules-format.en.md

@@ -41,7 +41,7 @@ A rule whose `match` carries a `network` block is a **network rule**. It matches
 | Field | Semantics |
 |---|---|
 | `domains` | Domain patterns, lowercased with a trailing dot stripped. A pattern without wildcards is subdomain-inclusive — `example.com` also matches `api.example.com`; `*.example.com` matches subdomains only; `*`/`**` compile as ordinary globs. ANY pattern matching the target host satisfies the dimension. |
-| `ips` | Exact IPv4/IPv6 literal, a glob (`10.0.*.*`), or an IPv4 CIDR (`10.0.0.0/8`). A literal IP in the URL is always a candidate; the proxy additionally resolves hostnames and tests their addresses, while `tools/pre-execute` matches literal IPs only (no DNS in the hot path). An IPv4-mapped IPv6 literal (`::ffff:169.254.169.254`, `::ffff:a9fe:a9fe`, `0:0:0:0:0:ffff:a9fe:a9fe`) normalizes to its dotted IPv4 form for matching, and a rule written in the mapped form also covers the plain IPv4 spelling. ANY match satisfies the dimension. |
+| `ips` | Exact IPv4/IPv6 literal, a glob (`10.0.*.*`), or an IPv4 CIDR (`10.0.0.0/8`). A literal IP in the URL is always a candidate; the proxy additionally resolves hostnames and tests their addresses, then **connects on the adjudicated address** (no second resolution, so DNS rebinding cannot move the connection to an address the rules never approved; a multi-address host falls back in adjudicated order), while `tools/pre-execute` matches literal IPs only (no DNS in the hot path). An IPv4-mapped IPv6 literal (`::ffff:169.254.169.254`, `::ffff:a9fe:a9fe`, `0:0:0:0:0:ffff:a9fe:a9fe`) normalizes to its dotted IPv4 form for matching, and a rule written in the mapped form also covers the plain IPv4 spelling. ANY match satisfies the dimension. |
 | `ports` | `*`, one port (`443`), or an inclusive range (`8000-9000`); numeric YAML ports are accepted. Evaluated against the effective port (URL port, else 80/443 by scheme). ANY match satisfies the dimension. |
 | `schemes` | `http` and/or `https`; the target scheme must be one of them. |
 

package/docs/rules-format.md

@@ -41,7 +41,7 @@ rules:        # 规则列表，按书写顺序求值；可以省略或为空
 | 字段 | 语义 |
 |---|---|
 | `domains` | 域名模式，小写化并去掉末尾点。无通配符的模式包含子域——`example.com` 同时命中 `api.example.com`；`*.example.com` 只匹配子域；`*`/`**` 按普通 glob 编译。任一模式命中目标主机即满足该维度。 |
-| `ips` | 精确 IPv4/IPv6 字面量、glob（`10.0.*.*`）或 IPv4 CIDR（`10.0.0.0/8`）。URL 中的字面量 IP 始终是候选；代理额外解析主机名并测试其地址，而 `tools/pre-execute` 只匹配字面量 IP（热路径不做 DNS）。IPv4 映射的 IPv6 字面量（`::ffff:169.254.169.254`、`::ffff:a9fe:a9fe`、`0:0:0:0:0:ffff:a9fe:a9fe`）归一化为其 IPv4 点分形式参与匹配，规则写成映射形式时同样覆盖普通 IPv4 写法。任一命中即满足。 |
+| `ips` | 精确 IPv4/IPv6 字面量、glob（`10.0.*.*`）或 IPv4 CIDR（`10.0.0.0/8`）。URL 中的字面量 IP 始终是候选；代理额外解析主机名并测试其地址，随后**按裁决到的地址建连**（不做二次解析，DNS rebinding 无法把连接改到未获批的地址；多地址主机按裁决顺序回退），而 `tools/pre-execute` 只匹配字面量 IP（热路径不做 DNS）。IPv4 映射的 IPv6 字面量（`::ffff:169.254.169.254`、`::ffff:a9fe:a9fe`、`0:0:0:0:0:ffff:a9fe:a9fe`）归一化为其 IPv4 点分形式参与匹配，规则写成映射形式时同样覆盖普通 IPv4 写法。任一命中即满足。 |
 | `ports` | `*`、单端口（`443`）或闭区间（`8000-9000`）；接受数值型 YAML 端口。按有效端口求值（URL 端口，否则按 scheme 取 80/443）。任一命中即满足。 |
 | `schemes` | `http` 和/或 `https`；目标 scheme 必须是其中之一。 |
 

package/docs/rules-format.schema.json

@@ -149,7 +149,7 @@
               "items": { "type": "string", "minLength": 1 }
             },
             "ips": {
-              "description": "IP literals, globs, or IPv4 CIDRs; ANY matching the target address satisfies the dimension.",
+              "description": "IP literals, globs, or IPv4 CIDRs; an IPv4-mapped IPv6 literal (::ffff:169.254.169.254, ::ffff:a9fe:a9fe) is unmapped to its dotted IPv4 form before matching, and a mapped pattern also covers the plain IPv4 spelling; ANY matching the target address satisfies the dimension.",
               "type": "array",
               "items": { "type": "string", "minLength": 1 }
             },

package/lib/index.js

@@ -2155,23 +2155,59 @@ var NetworkProxy = class {
 			res.end("permission-rules proxy: only absolute-form proxy requests are served here\n");
 			return;
 		}
-		await this.forwardOrBlock(res, target, () => {
-			const upstream = new URL(req.url);
-			const proxyReq = (upstream.protocol === "https:" ? request$1 : request)(upstream, {
-				method: req.method,
-				headers: req.headers
-			}, (proxyRes) => {
-				res.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers);
-				proxyRes.pipe(res);
-			});
-			proxyReq.on("error", (error) => {
-				if (!res.headersSent) {
-					res.writeHead(502, { "content-type": "text/plain" });
-					res.end(`[network: upstream error] ${String(error)}\n`);
-				} else res.destroy();
+		const { decision, target: adjudicated } = await this.decideWithResolution(target);
+		if (decision.action !== "allow") {
+			this.recordBlock(decision, target);
+			const body = blockMessage(decision);
+			res.writeHead(403, {
+				"content-type": "text/plain; charset=utf-8",
+				"content-length": Buffer.byteLength(body)
 			});
-			req.pipe(proxyReq);
+			res.end(body);
+			return;
+		}
+		const upstream = new URL(req.url);
+		const send = upstream.protocol === "https:" ? request$1 : request;
+		const pinned = pinnedAddresses(adjudicated);
+		const proxyReq = send(upstream, {
+			method: req.method,
+			headers: req.headers,
+			...pinned.length === 0 ? {} : { lookup: pinnedLookup(pinned) }
+		}, (proxyRes) => {
+			res.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers);
+			proxyRes.pipe(res);
+		});
+		proxyReq.on("error", (error) => {
+			if (!res.headersSent) {
+				res.writeHead(502, { "content-type": "text/plain" });
+				res.end(`[network: upstream error] ${String(error)}\n`);
+			} else res.destroy();
 		});
+		req.pipe(proxyReq);
+	}
+	/**
+	* Connect to the first adjudicated address that accepts, so the tunnel lands
+	* on an address the decision approved; a hostname target with no resolution
+	* keeps the historical hostname connect. Each candidate is tried in order so
+	* a multi-address host does not lose its fallback.
+	*/
+	async connectUpstream(target, port) {
+		const pinned = pinnedAddresses(target);
+		if (pinned.length === 0) return connect(port, target.host);
+		let lastError;
+		for (const address of pinned) try {
+			return await new Promise((resolve, reject) => {
+				const socket = connect(port, address);
+				socket.once("connect", () => resolve(socket));
+				socket.once("error", (error) => {
+					socket.destroy();
+					reject(error instanceof Error ? error : new Error(String(error)));
+				});
+			});
+		} catch (error) {
+			lastError = error;
+		}
+		throw lastError instanceof Error ? lastError : /* @__PURE__ */ new Error("no adjudicated address accepted the connection");
 	}
 	/** CONNECT tunneling (HTTPS and friends): adjudicate, then either 403 or an established TCP tunnel. */
 	async handleConnect(req, socket, head) {
@@ -2186,14 +2222,21 @@ var NetworkProxy = class {
 			socket.end("HTTP/1.1 400 Bad Request\r\n\r\n");
 			return;
 		}
-		const decision = await this.decideWithResolution(target);
+		const { decision, target: adjudicated } = await this.decideWithResolution(target);
 		if (decision.action !== "allow") {
 			this.recordBlock(decision, target);
 			const body = blockMessage(decision);
 			socket.end(`HTTP/1.1 403 Forbidden\r\ncontent-type: text/plain\r\ncontent-length: ${Buffer.byteLength(body)}\r\n\r\n${body}`);
 			return;
 		}
-		const tunnel = connect(target.port ?? 443, target.host);
+		let tunnel;
+		try {
+			tunnel = await this.connectUpstream(adjudicated, target.port ?? 443);
+		} catch (error) {
+			this.options.logger.warn(`permission-rules: upstream connect failed for ${target.host}: ${String(error)}`);
+			socket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
+			return;
+		}
 		tunnelHolder.tunnel = tunnel;
 		this.sockets.add(socket);
 		this.sockets.add(tunnel);
@@ -2204,27 +2247,10 @@ var NetworkProxy = class {
 		socket.on("close", cleanup);
 		tunnel.on("close", cleanup);
 		tunnel.on("error", () => socket.destroy());
-		tunnel.once("connect", () => {
-			socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
-			if (head.length > 0) tunnel.write(head);
-			tunnel.pipe(socket);
-			socket.pipe(tunnel);
-		});
-	}
-	/** Adjudicate one plain-HTTP request; deny/ask blocks with a structured 403 before any forwarding. */
-	async forwardOrBlock(res, target, forward) {
-		const decision = await this.decideWithResolution(target);
-		if (decision.action !== "allow") {
-			this.recordBlock(decision, target);
-			const body = blockMessage(decision);
-			res.writeHead(403, {
-				"content-type": "text/plain; charset=utf-8",
-				"content-length": Buffer.byteLength(body)
-			});
-			res.end(body);
-			return;
-		}
-		forward();
+		socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+		if (head.length > 0) tunnel.write(head);
+		tunnel.pipe(socket);
+		socket.pipe(tunnel);
 	}
 	/** Resolve a hostname once so `ips`-scoped rules see the real addresses, then decide. */
 	async decideWithResolution(target) {
@@ -2233,12 +2259,21 @@ var NetworkProxy = class {
 				all: true,
 				verbatim: true
 			})).map((entry) => entry.address);
-			if (resolved.length > 0) return this.options.decide({
-				...target,
-				ips: [...target.ips, ...resolved]
-			});
+			if (resolved.length > 0) {
+				const effective = {
+					...target,
+					ips: [...target.ips, ...resolved]
+				};
+				return {
+					decision: await this.options.decide(effective),
+					target: effective
+				};
+			}
 		} catch {}
-		return this.options.decide(target);
+		return {
+			decision: await this.options.decide(target),
+			target
+		};
 	}
 	/** Record a block: counters, recent ring, and the runtime hook (logger + session audit). */
 	recordBlock(decision, target) {
@@ -2285,6 +2320,33 @@ function connectTarget(authority) {
 	};
 }
 /**
+* The literal addresses a connection may use — everything the decision was
+* made on. Returning them keeps the connection on an adjudicated address
+* instead of letting a second DNS lookup pick a different one.
+* @param target - the adjudicated target.
+* @returns the adjudicated literal addresses, in decision order.
+*/
+function pinnedAddresses(target) {
+	return target.ips.filter((candidate) => isIpLiteral(candidate));
+}
+/**
+* A `lookup` that answers from the adjudicated address list without a second
+* DNS query. Node's happy-eyeballs path asks with `all: true` and tries the
+* returned addresses in order, so a multi-address host keeps its fallbacks.
+* @param addresses - the adjudicated literal addresses.
+* @returns the lookup function handed to `http(s).request`.
+*/
+function pinnedLookup(addresses) {
+	const resolved = addresses.map((address) => ({
+		address,
+		family: address.includes(":") ? 6 : 4
+	}));
+	return (_hostname, options, callback) => {
+		if (options.all === true) callback(null, resolved);
+		else callback(null, resolved[0].address, resolved[0].family);
+	};
+}
+/**
 * Inject the proxy environment variables for subprocesses and return a
 * disposer restoring every previous value exactly (so updates and
 * uninstalls leave the host environment untouched). `noProxy: 'clear'`

package/lib/types/proxy.d.ts

@@ -99,10 +99,15 @@ export declare class NetworkProxy {
     close(): Promise<void>;
     /** Plain-HTTP proxying: absolute-form requests are adjudicated and forwarded (or blocked with a structured 403). */
     private handleRequest;
+    /**
+     * Connect to the first adjudicated address that accepts, so the tunnel lands
+     * on an address the decision approved; a hostname target with no resolution
+     * keeps the historical hostname connect. Each candidate is tried in order so
+     * a multi-address host does not lose its fallback.
+     */
+    private connectUpstream;
     /** CONNECT tunneling (HTTPS and friends): adjudicate, then either 403 or an established TCP tunnel. */
     private handleConnect;
-    /** Adjudicate one plain-HTTP request; deny/ask blocks with a structured 403 before any forwarding. */
-    private forwardOrBlock;
     /** Resolve a hostname once so `ips`-scoped rules see the real addresses, then decide. */
     private decideWithResolution;
     /** Record a block: counters, recent ring, and the runtime hook (logger + session audit). */

package/lib/types/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAGhE,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE3D,oHAAoH;AACpH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAyF,CAAA;AAEtI,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAA6B,CAAA;AAE7E,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAA;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,sGAAsG;AACtG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE;YAAE,MAAM,CAAC,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;gBAAE,SAAS,CAAC,EAAE,IAAI,CAAA;aAAE,GAAG,OAAO,CAAA;SAAE,CAAA;KACtH,CAAA;CACF;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,kDAAkD;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,eAAe,CAAA;IAC3D,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,gBAAgB,GAAG,SAAS,CAAA;IACzD,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,GAAG,SAAS,KAAK,IAAI,CAAA;IAClG,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CACjD;AAED;;;;;GAKG;AACH,qBAAa,YAAY;IAOX,OAAO,CAAC,QAAQ,CAAC,OAAO;IANpC,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6C;IACnE,OAAO,CAAC,UAAU,CAAI;gBAEO,OAAO,EAAE,mBAAmB;IAEzD,2DAA2D;IAC3D,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,+EAA+E;IAC/E,YAAY,IAAI,SAAS,kBAAkB,EAAE;IAI7C,iCAAiC;IACjC,UAAU,IAAI,YAAY;IAI1B,kDAAkD;IAClD,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IA4BxB,kFAAkF;IAClF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,oHAAoH;YACtG,aAAa;IA0B3B,uGAAuG;YACzF,aAAa;IA4C3B,sGAAsG;YACxF,cAAc;IAY5B,yFAAyF;YAC3E,oBAAoB;IAalC,4FAA4F;IAC5F,OAAO,CAAC,WAAW;CA4BpB;AAYD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,IAAI,CAyBtF"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAGhE,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE3D,oHAAoH;AACpH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAyF,CAAA;AAEtI,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAA6B,CAAA;AAE7E,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAA;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,sGAAsG;AACtG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE;YAAE,MAAM,CAAC,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;gBAAE,SAAS,CAAC,EAAE,IAAI,CAAA;aAAE,GAAG,OAAO,CAAA;SAAE,CAAA;KACtH,CAAA;CACF;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,kDAAkD;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,eAAe,CAAA;IAC3D,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,gBAAgB,GAAG,SAAS,CAAA;IACzD,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,GAAG,SAAS,KAAK,IAAI,CAAA;IAClG,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CACjD;AAED;;;;;GAKG;AACH,qBAAa,YAAY;IAOX,OAAO,CAAC,QAAQ,CAAC,OAAO;IANpC,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6C;IACnE,OAAO,CAAC,UAAU,CAAI;gBAEO,OAAO,EAAE,mBAAmB;IAEzD,2DAA2D;IAC3D,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,+EAA+E;IAC/E,YAAY,IAAI,SAAS,kBAAkB,EAAE;IAI7C,iCAAiC;IACjC,UAAU,IAAI,YAAY;IAI1B,kDAAkD;IAClD,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IA4BxB,kFAAkF;IAClF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,oHAAoH;YACtG,aAAa;IAyC3B;;;;;OAKG;YACW,eAAe;IAqB7B,uGAAuG;YACzF,aAAa;IAiD3B,yFAAyF;YAC3E,oBAAoB;IAgBlC,4FAA4F;IAC5F,OAAO,CAAC,WAAW;CA4BpB;AAsCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,IAAI,CAyBtF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-permission-rules",
-  "version": "0.6.16",
+  "version": "0.6.18",
   "description": "Declarative Claude Code-style permission rules plus a Codex-style process-level network policy for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), workspace-path, and network-target (domain/ip/port/scheme) matching on the tools/pre-execute waterfall, a built-in local HTTP/CONNECT proxy governing shell subprocess traffic, three network modes mapped onto the official sandbox presets, full session-log audit, HMR rule reload, and a settings page with a rule editor, block counters, and recent interception lists.",
   "private": false,
   "type": "module",
@@ -76,7 +76,7 @@
       "network:outbound"
     ],
     "compatibility": {
-      "dshVersions": ["0.1.2-rc.1","0.1.5-alpha.1"]
+      "dshVersions": ["0.1.2-rc.1","0.1.5-rc.1"]
     },
     "capability": {
       "id": "rules",
@@ -154,31 +154,31 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-attachment": "0.1.5-alpha.1",
+    "@deepseek-ai/dsh-attachment": "0.1.5-rc.1",
     "@deepseek-ai/cordis": "^4.0.2",
     "@deepseek-ai/cordis-plugin-include": "^1.0.7",
     "@deepseek-ai/cordis-plugin-loader": "^1.0.3",
-    "@deepseek-ai/dsh-agent": "0.1.5-alpha.1",
-    "@deepseek-ai/dsh-brand": "0.1.5-alpha.1",
-    "@deepseek-ai/dsh-client-connection": "0.1.5-alpha.1",
-    "@deepseek-ai/dsh-client-locale": "0.1.5-alpha.1",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.5-alpha.1",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.5-alpha.1",
-    "@deepseek-ai/dsh-client-web": "0.1.5-alpha.1",
-    "@deepseek-ai/dsh-commands": "0.1.5-alpha.1",
-    "@deepseek-ai/dsh-invariants": "0.1.5-alpha.1",
-    "@deepseek-ai/dsh-llm": "0.1.5-alpha.1",
-    "@deepseek-ai/dsh-session": "0.1.5-alpha.1",
-    "@deepseek-ai/dsh-session-projection": "0.1.5-alpha.1",
-    "@deepseek-ai/dsh-subagent": "0.1.5-alpha.1",
-    "@deepseek-ai/dsh-tools": "0.1.5-alpha.1",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.5-alpha.1",
-    "@deepseek-ai/dsh-user-approval": "0.1.5-alpha.1",
+    "@deepseek-ai/dsh-agent": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-brand": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-connection": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-locale": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-web": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-commands": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-invariants": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session-projection": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-subagent": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-user-approval": "0.1.5-rc.1",
     "@deepseek-ai/schemastery": "^3.18.2",
     "@eslint/js": "^10.0.1",
     "@types/node": "^22.19.0",
     "@vitest/coverage-v8": "^3.2.0",
-    "dsh-auto-review": "file:vendor/dsh-auto-review-0.12.1.tgz",
+    "dsh-auto-review": "file:vendor/dsh-auto-review-0.12.2.tgz",
     "eslint": "^10.8.1",
     "globals": "^17.11.0",
     "react": "18.3.1",

package/scripts/repair-session-logs.mjs

@@ -82,13 +82,14 @@ const STORAGE_ROW_TYPES = new Set([
 /**
  * The harness build's generated event vocabulary
  * (`KNOWN_SESSION_EVENT_TYPES`, `packages/core/session/src/known-event-types.ts`,
- * synced with the `0.1.5-alpha.1` catalog), plus the v1/v2-only spellings the
+ * synced with the `0.1.5-rc.1` catalog), plus the v1/v2-only spellings the
  * older generations wrote (`assistant/chunk`, `tool/code-dispatch`,
  * `tool/code-dispatch-start`; V3 renamed the latter two to `tool/ptc-dispatch`
  * and `tool/ptc-dispatch-start`), so every generation scans clean. Rows whose
  * type is outside this set are what the read path refuses when the envelope
  * lacks `ignorable: true`; the scan reports them so nothing is missed.
- * Regenerate this list from the harness checkout when it changes.
+ * Regenerate this list from the harness checkout when it changes (0.1.5-rc.1
+ * added `deliverables/presented` and `subagent/catalog`).
  */
 const KNOWN_SESSION_EVENT_TYPES = new Set([
   'agent-preset/selected',
@@ -107,6 +108,7 @@ const KNOWN_SESSION_EVENT_TYPES = new Set([
   'compaction/prune',
   'compaction/start',
   'compaction/summary',
+  'deliverables/presented',
   'feedback/message-delete',
   'feedback/message-put',
   'feedback/record',
@@ -128,6 +130,7 @@ const KNOWN_SESSION_EVENT_TYPES = new Set([
   'session/title-llm-request',
   'step/end',
   'step/start',
+  'subagent/catalog',
   'subagent/descriptor',
   'subagent/model-selection-policy',
   'system/message',

package/src/proxy.ts

@@ -21,7 +21,7 @@ import { connect } from 'node:net'
 import { lookup } from 'node:dns/promises'
 import type { AddressInfo } from 'node:net'
 import type { Duplex } from 'node:stream'
-import type { Server, IncomingMessage, ServerResponse } from 'node:http'
+import type { Server, IncomingMessage, RequestOptions, ServerResponse } from 'node:http'
 import type { CallId } from './call-id.ts'
 import type { NetworkDecision, NetworkMode } from './network.ts'
 import { blockMessage } from './network.ts'
@@ -163,23 +163,65 @@ export class NetworkProxy {
       res.end('permission-rules proxy: only absolute-form proxy requests are served here\n')
       return
     }
-    await this.forwardOrBlock(res, target, () => {
-      const upstream = new URL(req.url as string)
-      const send = upstream.protocol === 'https:' ? httpsRequest : httpRequest
-      const proxyReq = send(upstream, { method: req.method, headers: req.headers }, proxyRes => {
-        res.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers)
-        proxyRes.pipe(res)
-      })
-      proxyReq.on('error', (error: unknown) => {
-        if (!res.headersSent) {
-          res.writeHead(502, { 'content-type': 'text/plain' })
-          res.end(`[network: upstream error] ${String(error)}\n`)
-        } else {
-          res.destroy()
-        }
-      })
-      req.pipe(proxyReq)
+    const { decision, target: adjudicated } = await this.decideWithResolution(target)
+    if (decision.action !== 'allow') {
+      this.recordBlock(decision, target)
+      const body = blockMessage(decision)
+      res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8', 'content-length': Buffer.byteLength(body) })
+      res.end(body)
+      return
+    }
+    const upstream = new URL(req.url as string)
+    const send = upstream.protocol === 'https:' ? httpsRequest : httpRequest
+    // The forwarded connection is pinned to the addresses the decision was made
+    // on, so a hostname that re-resolves between adjudication and connect
+    // (DNS rebinding) cannot reach an address the rules never approved.
+    const pinned = pinnedAddresses(adjudicated)
+    const options: RequestOptions = {
+      method: req.method,
+      headers: req.headers,
+      ...(pinned.length === 0 ? {} : { lookup: pinnedLookup(pinned) }),
+    }
+    const proxyReq = send(upstream, options, proxyRes => {
+      res.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers)
+      proxyRes.pipe(res)
+    })
+    proxyReq.on('error', (error: unknown) => {
+      if (!res.headersSent) {
+        res.writeHead(502, { 'content-type': 'text/plain' })
+        res.end(`[network: upstream error] ${String(error)}\n`)
+      } else {
+        res.destroy()
+      }
     })
+    req.pipe(proxyReq)
+  }
+
+  /**
+   * Connect to the first adjudicated address that accepts, so the tunnel lands
+   * on an address the decision approved; a hostname target with no resolution
+   * keeps the historical hostname connect. Each candidate is tried in order so
+   * a multi-address host does not lose its fallback.
+   */
+  private async connectUpstream(target: NetworkTarget, port: number): Promise<Duplex> {
+    const pinned = pinnedAddresses(target)
+    if (pinned.length === 0) return connect(port, target.host)
+    let lastError: unknown
+    for (const address of pinned) {
+      try {
+        return await new Promise<Duplex>((resolve, reject) => {
+          const socket = connect(port, address)
+          socket.once('connect', () => resolve(socket))
+          socket.once('error', (error: unknown) => {
+            socket.destroy()
+            reject(error instanceof Error ? error : new Error(String(error)))
+          })
+        })
+      } catch (error) {
+        lastError = error
+      }
+    }
+    throw lastError instanceof Error ? lastError : new Error('no adjudicated address accepted the connection')
   }
 
   /** CONNECT tunneling (HTTPS and friends): adjudicate, then either 403 or an established TCP tunnel. */
@@ -201,14 +243,21 @@ export class NetworkProxy {
       socket.end('HTTP/1.1 400 Bad Request\r\n\r\n')
       return
     }
-    const decision = await this.decideWithResolution(target)
+    const { decision, target: adjudicated } = await this.decideWithResolution(target)
     if (decision.action !== 'allow') {
       this.recordBlock(decision, target)
       const body = blockMessage(decision)
       socket.end(`HTTP/1.1 403 Forbidden\r\ncontent-type: text/plain\r\ncontent-length: ${Buffer.byteLength(body)}\r\n\r\n${body}`)
       return
     }
-    const tunnel = connect(target.port ?? 443, target.host)
+    let tunnel: Duplex
+    try {
+      tunnel = await this.connectUpstream(adjudicated, target.port ?? 443)
+    } catch (error) {
+      this.options.logger.warn(`permission-rules: upstream connect failed for ${target.host}: ${String(error)}`)
+      socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n')
+      return
+    }
     tunnelHolder.tunnel = tunnel
     this.sockets.add(socket)
     this.sockets.add(tunnel)
@@ -219,39 +268,27 @@ export class NetworkProxy {
     socket.on('close', cleanup)
     tunnel.on('close', cleanup)
     tunnel.on('error', () => socket.destroy())
-    tunnel.once('connect', () => {
-      socket.write('HTTP/1.1 200 Connection Established\r\n\r\n')
-      if (head.length > 0) tunnel.write(head)
-      tunnel.pipe(socket)
-      socket.pipe(tunnel)
-    })
-  }
-
-  /** Adjudicate one plain-HTTP request; deny/ask blocks with a structured 403 before any forwarding. */
-  private async forwardOrBlock(res: ServerResponse, target: NetworkTarget, forward: () => void): Promise<void> {
-    const decision = await this.decideWithResolution(target)
-    if (decision.action !== 'allow') {
-      this.recordBlock(decision, target)
-      const body = blockMessage(decision)
-      res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8', 'content-length': Buffer.byteLength(body) })
-      res.end(body)
-      return
-    }
-    forward()
+    socket.write('HTTP/1.1 200 Connection Established\r\n\r\n')
+    if (head.length > 0) tunnel.write(head)
+    tunnel.pipe(socket)
+    socket.pipe(tunnel)
   }
 
   /** Resolve a hostname once so `ips`-scoped rules see the real addresses, then decide. */
-  private async decideWithResolution(target: NetworkTarget): Promise<NetworkDecision> {
+  private async decideWithResolution(target: NetworkTarget): Promise<{ decision: NetworkDecision; target: NetworkTarget }> {
     if (!isIpLiteral(target.host)) {
       try {
         const addresses = await lookup(target.host, { all: true, verbatim: true })
         const resolved = addresses.map(entry => entry.address)
-        if (resolved.length > 0) return this.options.decide({ ...target, ips: [...target.ips, ...resolved] })
+        if (resolved.length > 0) {
+          const effective: NetworkTarget = { ...target, ips: [...target.ips, ...resolved] }
+          return { decision: await this.options.decide(effective), target: effective }
+        }
       } catch {
         // Unresolvable target: decide on the literal name (ip-scoped rules simply cannot fire).
       }
     }
-    return this.options.decide(target)
+    return { decision: await this.options.decide(target), target }
   }
 
   /** Record a block: counters, recent ring, and the runtime hook (logger + session audit). */
@@ -295,6 +332,32 @@ function connectTarget(authority: string): NetworkTarget | undefined {
   return { scheme: 'https', host, port, ips: isIpLiteral(host) ? [host] : [] }
 }
 
+/**
+ * The literal addresses a connection may use — everything the decision was
+ * made on. Returning them keeps the connection on an adjudicated address
+ * instead of letting a second DNS lookup pick a different one.
+ * @param target - the adjudicated target.
+ * @returns the adjudicated literal addresses, in decision order.
+ */
+function pinnedAddresses(target: NetworkTarget): readonly string[] {
+  return target.ips.filter(candidate => isIpLiteral(candidate))
+}
+
+/**
+ * A `lookup` that answers from the adjudicated address list without a second
+ * DNS query. Node's happy-eyeballs path asks with `all: true` and tries the
+ * returned addresses in order, so a multi-address host keeps its fallbacks.
+ * @param addresses - the adjudicated literal addresses.
+ * @returns the lookup function handed to `http(s).request`.
+ */
+function pinnedLookup(addresses: readonly string[]): NonNullable<RequestOptions['lookup']> {
+  const resolved = addresses.map(address => ({ address, family: address.includes(':') ? 6 : 4 }))
+  return (_hostname, options, callback) => {
+    if (options.all === true) callback(null, resolved)
+    else callback(null, resolved[0]!.address, resolved[0]!.family)
+  }
+}
+
 /**
  * Inject the proxy environment variables for subprocesses and return a
  * disposer restoring every previous value exactly (so updates and